We expect that with a worldwide contribution, the Attack and Vulnerability reference guides can become the most complete and updated security reference available. Also, we expect to create cross-reference among OWASP documents, using the same concepts, definitions, and categories in order to inter-link all the documents.

We expect that with a worldwide contribution, the Attack and Vulnerability reference guides can become the most complete and updated security reference available. Also, we expect to create cross-reference among OWASP documents, using the same concepts, definitions, and categories in order to inter-link all the documents.

I'm 24 year old system administrator/it security specialist with 6 years experience.

+

Also I'm speaker at many different meetings about IT Security (e.g. at OWASP Poland Local Chapter in April 2007) and student Computer Science (last year).

+

+

===* Application security experience===

+

+

I have 5 years experience in security audits. Mainly applications for linux/win32 platform, but since 2 years I'm _interested_ web security. I know many attacks vectors, what and how I can do it with security bug and how correct (e.g. changes in code, configuration or something else).

+

In 2004 year I wrote my first article about bugs in code. Currently I preparing presentation at FIRST! OWASP Poland Local Chapter Meeting about "secure programming in practice".

+

+

===* Participation and leadership in open communities===

+

+

I'm member of ISACA Poland and (I hope so!) OWASP Poland Local Chapter.

+

+

===* Objectives or ways in which you will meet the goal(s)===

+

+

1) flesh out any item complete from [[:Category:Attack|Attacks]] list

+

2) complete any item which is not complete or is blank

+

3) refresh [[:Category:Attack|Attacks]] list, everyday is new for new vectors attacks

+

+

===* Specific activities and who will carry out these activities===

+

+

Security education for newbie, medium-advanced and advanced people. Currently mainly via presentation on ISACA Poland meetings. My protector in this education is Shadow (sorry, I don't know in this moment if I mind operate his (first/last)name).

+

+

===* Specific deliverables and a rough project schedule so we can track progress===

+

+

My goals list (3 points) is good for make progress bar. First and second goals this is base what I want do it. Third goal is a little research working, but this is what I WANT do it in my life :)

+

+

===* Long-term vision for the project===

+

+

If [[:Category:Attack|Attacks]] list is complete (9th July) in cycle on one year this work must be refresh. Very important is update [[:Category:Attack|Attacks]] list every time when you hired about new vector attacks. Why? Because when description about this news vector attacks is not complete, in the next year you don't must making 3 goals, just 2 (first and second). Perfectly when any new item at [[:Category:Attack|Attacks]] list is develop at moment emerge or even though max. 3 months for someone wrote it.

+

+

===* Any other reasons why you and your project should be selected===

+

+

Why I? Because I have experience, skills, goodwill and free time.

+

Why this project? Because this is strong base for education for any programmer, administrator and many others professionals. Knowledge attacks vectors... this is helpful for more secure not only (e-)world.

{Your first name or Alias} - {Project name}

Please remember that projects will be selected and funded based on how well they meet the Selection Criteria.

You can propose your project in any form you wish, but the best proposals will be well thought out, clear and concise, and reflective of your passion for the topic. We strongly suggest that you include the following information in your proposal.

Your educational and professional background

Application security experience and accomplishments

Participation and leadership in open communities

The opportunity, challenges, issues or need your proposal addresses

Objectives or ways in which you will meet the goal(s)

Specific activities and who will carry out these activities

Specific deliverables and a rough project schedule so we can track progress

Long-term vision for the project

Any other reasons why you and your project should be selected

Buanzo - Enigform: Firefox Addon for OpenPGP signing of HTTP requests

I am a 25 year old Independent security consultant from Buenos Aires, Argentina, that has contributed to the world of
information systems security since 1994, when BBSes and Linux still lived together.

A quick search for buanzo on google [1] will provide all necessary details about my professional and community background. For comprobable experience, you could also check my Rent a Coder profile.[2].

In my free time I like playing with my Punk-Pop band [3], Futurabanda. [4], and maintaining my Restaurants, Wines and Recipes site. [5]. I have to admit that my first priorities are my beloved son [6] and my wonderful wife [7].

Accomplishments

I've contributed scripts, fixes and translations to the Nmap project. I've also acted as Expert Contributor for SANS TOP-20 2004, 2005 and 2006. I've developed
tools that can be found in Freshmeat, like mprl (a getty enhancement to allow remote logins from the login: prompt of the console). I've also written
the Unix chapter of the OISSG's Information Systems Security Assessment Framework, v0.1 [8]. I'm currently writing
an Internet Draft to be proposed for RFC regarding Enigform.

Community

I run the official 2600 meetings site for Argentina [9], I've been proposed, but I refused, for President of the Argentinian Free Software group called SOLAR [www.solar.org.ar]. I'm an active member of the FLOSS community since 1996, having written articles in magazines http://www.net-security.org/dl/articles/Detecting_and_Understanding_rootkits.txt, made TV, radio
and newspaper appearances [10] and led different security research groups of Spain, Mexico and Argentina. Currently I contribute time thorugh my sites, forums and blogs,
answering questions in mailing lists and helping coordinate some local LUGs. I do also manager the Linux Counter for Argentina [11].

My Project

Enigform [12] is a Firefox extension that enhances HTTP with OpenPGP functionality. It digitally signs outgoing HTTP requests so that a web server can authenticate the identity and data of the incoming request. It is a Web Security tool because it can, if correctly implemented as any OpenPGP based technology, render man in the middle attacks useless. I think OpenPGP already speaks for itself regarding eMail. Imagine the same benefits for http and web applications. I think Enigform can fit into the OWASP Validation Project [13].

Enigform is the reference implementation of the Internet Draft I'm working on, in discussion with members of the IETF's OpenPGP Working Group.

Long Term

Have the Draft be proposed as a Standards Track RFC document, have Enigform support directly in Apache and IIS, and port Enigform to other browsers
and/or programming languages, and also provide OpenPGP De/Encryption support.

Why should I be selected

I have the experience, security awareness and means to make this project THE web security project of the decade. I am a respected member of the
international security community, and I firmly believe Enigform is my greatest idea so far.

Eoin Keary - Code review Project

Executive Summary:

I am proposing that I complete the OWASP Code review guide during this period.
The code review guide was started by me in 2005 and has much information on reviewing code for common vulnerabilities. It is frequently accessed (looking at the stats on the OWASP site) and therefore is useful to practitioners.

I believe the code review guide is an integral part of the OWASP BOK (Body of Knowledge). Ensuring secure development is key to secure applications and code review is of paramount importance in this domain.

There are many sections still to be added and more to be readjusted and rewritten to reflect the current state of the security world.
Much needs to be written on Web 2.0 technologies and distributed B2B technologies such as Webservices.

The Code review process and procedure needs also to be covered. A guide to establishing a mature code review process also needs to be done.
Code review methodologies also need to be discussed.

Objectives and Deliverables:

Update of the code review guide:

Add additional areas relating to the code review process such as:

Benefits and pitfalls

Methodology

The code review process

Transactional analysis

Managing the code review process

Assigning risk to findings

Technical guides

Language specific best practice

Java

.NET

PHP

MySQL

Stored Procs

C/C++

Code review by vulnerability:

Reviewing Code for Buffer Overruns and Overflows

Reviewing Code for OS Injection

Reviewing Code for SQL Injection

Reviewing Code for Data Validation

Reviewing code for XSS issues

Reviewing Code for Error Handling

Reviewing Code for Logging Issues

Reviewing The Secure Code Environment

Reviewing code for Authorization Issues

Reviewing code for Authentication Issues

Reviewing code for Session Integrity

Reviewing code for Cross Site Request Forgery

Reviewing code for Cryptography implementation issues

Reviewing code Dangerous HTTP Methods (Deployment)

Race Conditions

The areas of code are structured giving a brief explanation, the anti-pattern (vulnerable pattern to look for) and a suggested fix.

Why I should be sponsored for the project:

I used to head up the code review team as part of the application security group in fidelity investments and have 5+ years of the secure code review process.
I also was the lead of the Testing guide until V2 was published via the Autumn of Code.

I have always delivered any work I have volunteered for on time.

I have been involved in OWASP projects for 2/3 years now and have always been an active contributor.

Paolo Perego - Owasp Orizon Project

Executive Summary:

Owasp Orizon [16] Project born in 2006 as answer to the lack of common engine and library usable by opensource code review related tools.

Sometimes a complete code review approach is not suitable for most customers who wants to harden their code which is being approaching release stage. For such a reason, I started writing Java objects that embeds most of the security checks against common web vulnerabilities (XSS, SQL injection, Session handling, ...) so that source code can be hardened with a small effort in terms of code rewriting.

I do believe that a common set of API and a common safe coding best practices library is one of the most important goals to bring application security to the developers.

Objectives and Deliverables:

Completing the static code review API section

improving programming language to XML translator

improving security best practices code review scan library

improving secure coding fashion best practices library

writing the pattern matching scan using the aformentioned libraries

Writing the java source code enforment objects

writing an object to handle form data values to avoid XSS

writing an object to handle form data values to avoid SQL Injection

writing an object to handle HttpRequest and HttpSession objects

Why I should be sponsored for the project:

Owasp Orizon is the first Owasp project I'm involved in. I'm also contributor of Owasp Italian chapter managed by Matteo Meucci and I'm talking at various speeches about application security and safe coding best practices.

I'm a security consultant working in ethical hacking and we're approaching code review and safe topics right now.
I'm a developer too so I understand also the "dark side" of the problem developing code with security in mind.

I work using the "release early release often" paradigm so to be concrete and let other people having something usable to work with.

Sebastien Deleersnyder - OWASP Education Project

Executive Summary:

This Education project aims to provide in building blocks of web application security information. These modules can be combined together in education tracks targeting different audiences.

Web Application Security Education and Awareness is needed throughout the entire organization, each area and level of organizations have specific needs and requirements regarding education. A manager needs other information than a security professional or developer. Novices to the profession require other training than people with several years of experience.

I started the successful Belgian Chapter 3 years ago and have actively contributed to OWASP since then. I also co-organized the European conference last year in Belgium.

This is the first separate project that I started, originating from a local demand to set up educational tracks for people that are new to Web Application Security. There are literally hundreds of presentations and an enormous amount of information on the OWASP web site. The goal of this project is to restructure pieces of that information in reusable modules that can be combined in educational tracks. It is my believe that awareness is an important cornerstone of building secure web applications, and this project will actively support that.

If we are granted Spoc 007 participation, I will be sharing the budget with all active participants. This will be an extra motivation for project participation. I will reinvest my part in the project to set up a web conferencing / web casting solution to be used to disseminate the project results and make them available for later use.

More details:

The detailed road map can be found here.
The SpoC 007 goal is to finish Sub Goals 1, 2, 3 and 4. If time permits we can start with sub goal 5.

Subere - OWASP JBroFuzz Project

Overview

JBroFuzz is a stateless network protocol fuzzer that emerged from the needs of penetration testing. The purpose of this application is to provide a single, portable application that offers stable cross-platform network protocol fuzzing capabilities. At the same time, JBroFuzz attempts to keep the User Interface (UI) as intuitive as possible.

Fuzzing

As seen by the emphasis given on the subject of fuzzing in the 2007 Testing Guide (v2), network protocol fuzzing serves as a fundamental cornerstone of application security testing. For this, many different categories and types of fuzzing have been defined.

Objectives

JBroFuzz needs to expand and grow in order to cover network fuzzing in a more complete manner. Its modular implementation allows for the addtion of new functionality by means of independent tabs. The key tabs proposed to be added during the spring of code 2007 are (details in next section):

Open Source Tab

NTLM Brute Force over HTTP/S Tab

Pure HTTP/S Fuzzing using HTTPClient

Blind SQL Injection Fuzzing Tab

At the same time, the following existing tabs need to be updated and made more robust (details in next section):

TCP Fuzzing tab allowing graph outputs

TCP Sniffing tab update thread Agent Queue

Update Generators file format

Include SOAP and XML fuzzing

This expansion process relates to stabilising code that is presently included in JBroFuzz, thus allowing it to run for extensive periods of time (24h+) as well as adding more functionality in terms of the three new tabs.

Deliverables

Based on the above, the new code elements that will be added are as follows:

Open Source Tab:Provide the ability to enumerate e-mails from newsgroups without breaching google automated search rules

NTLM Brute Force over HTTP/S Tab:Provide the ability to enumerate NTLM as well as brute over HTTP/S NTLM.

Pure HTTP/S Fuzzing:Implement a fuzzing tab utilising HTTPClient from Jakarta that will also allow for multi-threading

Blind SQL Fuzzing TabImplement a tab that extracts information from a blind SQL injection point identified on web server over HTTP/HTTPS.

For updating existing code elements that require a partial rewrite, the following areas of focus are presented in detail:

TCP Fuzzing tab allowing graph outputs:Provide the ability to graph fuzzing results during a particular session run. This will give the ability to integrate and pickup potential fuzzing patterns.

TCP Sniffing tab update thread Agent Queue:Update the code of the sniffing panel in order to handle threaded agents in a more memory efficient way.

Update Generators file format:Update the generators file format to allow for the parsing and creation of recursive generators.

Include SOAP and XML fuzzing:Include an up to date list of SOAP and XML fuzzing templates.

Overall, the above two lists of changes should provide sufficient complexity and output for the spring of code 2007, forming a challenging implementation project.

Background

In its short life, the OWASP JBroFuzz Project has attracted the interest of the online security community with a total of appr. 5000 downloads in the last months.

Coming from a strong java background (5+ years) I decided to implement and release JBroFuzz in order to initially simplify penetrations testing processes that relate to web application and network protocol fuzzing.

I see the spring of code 2007 as a unique opportunity to industrialise network protocol fuzzing (and in particular HTTP/S fuzzing) within a single application, residing within OWASP.

Why should JBroFuzz be sponsored?

Centralising fuzzing resources into one application that has the ability to handle network protocol fuzzing over HTTP and HTTPS in a simple and intuitive manner forms an area of focus that should not be dismissed in building secure software applications.

Keep the code platform independent adds a huge advantage.

Receving an OWASP grant from the spring of code 2007 will trigger a share in the budget with all active participants depending on their level of involvement. This will be a direct function of the number of tabs and/or user functionality that they have assisted in implementing.

Joshua Perrymon - OWASP LiveCD Project

Executive Summary:

I am proposing that I complete the second version of the OWASP LiveCD during this period.
The first version of the LiveCD is now available and include many of the current OWASP documents and tools. I believe the LiveCD is one of the best mediums to promote OWASP tools and documentation. It is portable and already being used by thousands of security proffesionals to perform application testing and training.

In the current state the CD is stable and contains a lot of tools. However, this is just the beginning. There is a LOT of work that needs to be completed. The entire CD experience needs to be branded using OWASP graphics. This shouls start with the boot screen and carry all the way through to the icons and desktop graphics. The CD should also inlcude the wiki and ALL the tools developed for OWASP.

Objectives and Deliverables:

Update of the LiveCD:

Complete OWASP branding

Add OWASP wiki

Add encryption capabilities

Add more OWASP tools

Add more pen-test tools such as;

VOIP, RFID, BlueTooth, Wireless, etc..

Why I should be sponsored for the project:

I had the idea of the LiveCD about a year ago and have worked very hard to get the first version developed. This was driven by my vision to make all of the OWASP tools available on a portable medium. The main difference in the OWASP liveCD vs. other live CDs is going to be the regularity of updates. If sponsorship can be obtained the CD could be updated on a monthly basis. Not once a year like other liveCDs. The CD will also include specialty tools and documentation to perform VOIP, RFID,Bluetooth, and wireless security assessments.

The list is of course long and not appropriate here……and while its easy to knock PCI, there is nothing better out there.

Solution and Deliverables

As opposed to me continuing saying what’s wrong with PCI DSS, it seems to me that OWASP is a perfect forum to simply create and publish a “better criteria”. This can either be adopted and implemented by an organization like OWASP or considered to be incorporated into the PCI or other security standards. We won't get bogged down in the politics up-front, but hold something good up to the world for people to adopt. This project would of course draw on and bring together many of the other OWASP Projects including the Guide (What is a secure web app), Testing Guides (How to test for a secure web app), WebGoat (part of how to certify an individual understands and can find web app issues) etc. Many of those projects may not be complete or a perfect fit today, but this project can bring a common connecting theme to a lot of very valuable IP that OWASP has built over the years. I will also create it in such as way that a corporate could adopt/adapt it themseles as well as an industry. Where other OWASP projects are not complete or currently suitable I will build a requirements doc that can be considered by those teams if they feel appropriate.

This project would address the;

Standard

A complete auditable (important) web site security standard suitable for modern e-commerce companies including

The technical things people should care about

The operational / management things people should care about

Certification Model

A complete framework for certification (ongoing) and implementation (including certifying auditors, ongoing validation etc). This will include for example the model for certifying auditors (including the actual test program); checklists and forms for auditors to complete and other supporting material.

Essentially its a complete blueprint for an organisation like OWASP or a regulatory body need to run a web site security certification program complete with the supporting material to implement it.

Note: This is no trivial task to get right. I would need to ensure I can commit to completing the work to a good quality. I think this will take at least 2 months from start to finish to complete but I think is very important for the industry and for potentially for OWASP. I wanted to gauge the interest by first posting this.

Erwin Geirnaert - OWASP Java Project

Executive Summary:

I would like to help the OWASP Java Project to gather all Java security related information and to document any domains that lack documentation.

Objectives and Deliverables:

The main objective I see is to gather all information in one place, where security experts and developers can find the information they need.
In order to get there, I need to collect all information in the OWASP Wiki, ask people if they want to donate it to OWASP so that we can include it as public material, add URLs, white-papers, references to books, ... And if time permits, write some documentation myself.

One deliverable is the OWASP Top 10 for J2EE applications with clear examples of vulnerabilities and mitigations.

Why you should be sponsored for the project:

I have more then 10 years experience in Java and J2EE and the last 6 years I have tested and broke a lot of web applications. I gave also some very successful J2EE security courses and web security courses. I spoke at different conferences about application security in Europe.
And I am responsible for the security track at Javapolis, one of the biggest Jave conferences in Europe.
I am the co-founder of ZION SECURITY where we do security testing, code review, design reviews, training,...
I'm also member of the OWASP Belgium board that started in March 2007.

Erwin Geirnaert - OWASP WebGoat Solutions Guide

Executive Summary:

WebGoat is used by a lot of people to learn about web application security and the different vulnerabilities. But it takes a lot of time to grasp how the tools like WebScarab work and how to use them effectively in WebGoat. I propose to create a walkthrough of the lessons in WebGoat so that people can learn from the solutions, without spoiling the fun.

Objectives and Deliverables:

The WebGoat Solutions Guide is a document that can be bundled with WebGoat. Each lesson contains a detailed solution with screenshots and tools. I created a PDF with the solution for WebGoat 4.0 but this is too big to load (15 MB) and is not very practical.

After a discussion with Bruce about this, we think that the solutions should be made like the existing Lessons Plan so it is easier to maintain and update when a lesson changes. This means that there will be documentation folder and an individual solution for each lesson.

Why you should be sponsored for the project:

I have more then 10 years experience in Java and J2EE and the last 6 years I have tested and broke a lot of web applications. I gave also some very successful J2EE security courses and web security courses. I spoke at different conferences about application security in Europe.
And I am responsible for the security track at Javapolis, one of the biggest Jave conferences in Europe.
I am the co-founder of ZION SECURITY where we do security testing, code review, design reviews, training,...
I'm also member of the OWASP Belgium board that started in March 2007.

Bunyamin Demir – OWASP WeBekci Project

Executive Summary:

Web application firewalls (WAF) are gaining importance among the information security technologies designed to protect web sites from attack. WAF solutions prevent attacks that network firewalls and intrusion detection systems can't and they require no modification of application source code. ModSecurity [17] is an open source web application firewall that runs as an Apache module. It is an embeddable web application firewall and it provides protection from a range of attacks against web applications. It is an open source project available to everyone; it however does not come with an admin panel.

I decided to provide this essential tool with a control panel which I believe will ease and thus encourage its usage.

ModSecurity allows for HTTP traffic monitoring and real-time analysis with no changes to existing infrastructure. My main goal is to analyze attacks and generate rules to change the configuration of the ModSecurity accordingly.

ModSecurity has a feature called “flexible rule engine” as its heart of Attack Prevention capability . It uses ModSecurity’s “Rule Language,” (a programming language designed to work with HTTP transaction data). It is easy to use and flexible; yet the system administrators need to learn its own rules to create what is called “Certified ModSecurity Rules” to be implemented. My control panel will automate the major code-generation in Rule Language.

Objectives and Deliverables:

Configuration : Will add all configuration parameter

Rule Generator: Will write all the Rules in Rule Language

Logging : Auditlog and debuglog will be added.

Multiple-DB : Will add PostgreSql and Sqlite support.

Why I should be sponsored for the project:

I am involved with OWASP Turkey [18] and interested very much in WAF. Even though this is my first project for OWASP, I am very much interested in every aspect of ModSecurity. With SpoC007’s support I will finalize my work on OWASP WeBekci [19].

ABSTRACT

One of the major goals of the Open Web Application Security Project is to educate developers in the field of application software security. Understanding the risks and threats associated with web application software is pivotal in building a mature application security process. While OWASP has made a significant impact in the professional industry, more time and energy should be focused towards the academic community. It is an unfortunate fact that most universities do not require a stringent software security course for their computer science students. Consequently, most young developers do not have the ability to assess and mitigate the risks and threats for their own applications. It is for this reason that we believe the Open Web Application Security Project should fund an initiative to encourage the adaptation of application software security methodologies in the academic course curriculum.

The Scholastic Application Security Project is intended to be the first step towards integrating security requirements in academic course curriculums. The primary goal of the project is to give students hands-on experience performing application security assessments using the tools and documentation found at http:///www.owasp.org. The assessment, lead by an application security professional, will demonstrate to students how the information and tools found at OWASP can be used to assess and ultimately increase the overall security posture of a web application.

This project contributes towards bridging the gap between academia and industry, by equipping students with hands-on ready-for-the-job-market skills in the application software securing industry.

PARTICIPANTS

The Scholastic Application Security Assessment Project requires that college level students, lead by an application security professional, perform a security audit on an open source web application using the tools and information available at OWASP.

OWASP UTILIZATION

The Scholastic Application Security Assessment Project requires heavy utilization of existing OWASP tools and utilities. Through this requirement, the project will illustrate the fact that existing OWASP resources can be used and heavily relied upon in a professional security audit. The following is a list of notable OWASP resources whose use will be documented throughout the assessment:

OWASP Top Ten 2007 - The security critical areas that the students will assess in the review

OWASP WebScarabNG – The primary proxy utility used throughout the assessment

THE FINAL REPORT

Students are required to follow the principle of “responsible disclosure” during the course of the security assessment. The developers of the open source application will be notified if any significant issues are found. Once the assessment is complete, a final report will be delivered to the application developers and the appropriate OWASP Spring of Code personnel. For each finding in the report, the students will be required to describe how the tools and information found at OWASP were used in the discovery.

HOW DOES OWASP BENEFIT?

The Scholastic Application Security Assessment Project is specifically designed to benefit the OWASP brand:

The OWASP Community…

will be provided a case study proving that the resources available at OWASP can be utilized in an academic environment, that can be later used in advertising the OWASP efforts to similar programs as the one at TU.

will be providing students a hands on experience in learning and testing for the latest web application security threats, thus potentially enlarging the OWASP community of contributors and supporters.

will be addressing the need to educate developers in the security critical areas.

will be seen as offering a professional level service to another open source project.

will be addressing one of the root causes of application software insecurity.

BACKGROUND

Eric Sheridan:

Earned a Bachelor’s of Science in Computer Science from Towson University

Graduate Student in Information Security at Johns Hopkins University

Application Security Engineer at Aspect Security

Lead of the OWASP Stinger Project and the OWASP Validation Project

Goran Trajkovski, PhD:

Has been teaching the Application Software Security course for the Computer Security undergraduate and master-level majors at TU since 2004 (TU has been a Center of Excellence in Information Assurance, designated by the NSA since 2002).

Assistant professor of Computer and Information Sciences at Towson University, and Director of its Cognitive Agency and Robotics Lab (CARoL).

Has lead curricular efforts in integrating application software security topics throughout the Computer Science and Computer Information Sciences curriculum

12 years of full time teaching experience in higher ed.

Boris - OWASP Site Generator

OWASP Site Generator is a great tool, but it could be even better and more widespread. There’s a lot room for improvements to both its functionality and user experience. The way I see it, main user needs to be addressed and specific development objectives for the next release of OWASP Site Generator would be:

User Needs

Create multiple types of sites easily

Track and analyze requests easily

Change the look and feel of the resulting sites easily

Create sites for multiple web backend technologies easily

Learn how to use OWASP Site Generator easily

Development Objectives

Create a vulnerability library that can be used for web services, HTML forms, AJAX, etc. instead of having to craft the same attack for each

Add support for logging of all received requests, as well as querying resulting log files

"Templatize" the code generation process, so it can support skinning of the resulting sites

"Templatize" the code generation process, so it can support different backend web technologies

Fix all significant defects in the current release of OWASP Site Generator

Redesign the GUI to make it more efficient and user friendly

Create a smooth setup program which would install both client and server components as effortlessly as possible

Write documentation and articles about it

Make the development process open to the public and, hopefully, driven by its feedback from day one

Why should I be sponsored for this project

Well, probably because of my past work on AoC (I just hope that won’t be the reason for me not to be sponsored :)

Boris - OWASP Report Generator

There is no doubt that OWASP Report Generator is a very handy tool for penetration testers and other security researchers, but it would be even better if some enhancements were made:

Make the development process open to the public and, hopefully, driven by its feedback from day one

Why should I be sponsored for this project

Well, probably because of my past work on AoC (I just hope that won’t be the reason for me not to be sponsored :)

Boris - OWASP Tiger

OWASP Tiger project is at its very beginning. Some new features are needed in order for it to become more useful. Here’s a short list:

User Needs

Easier editing of test projects

Support for testing sites that require authentication

Support for testing sites that require use of cookies

An easy way of specifying vulnerability data, ideally an automated one

More flexible reporting

More project templates

More documentation

Development Objectives

Add support for cookies

Add support for standard authentication schemes

Add support for importing vulnerability data from a test definition (or a vulnerability library)

Make use of OWASP Report Generator for more advanced reports

Create a setup program that would install both client and project templates and also allow for adding new templates after the initial installation

Write documentation and articles about it

Make the development process open to the public and, hopefully, driven by its feedback from day one

Why should I be sponsored for this project

Well, probably because of my past work on AoC (I just hope that won’t be the reason for me not to be sponsored :)

Heiko - Web Application Security put into practice

I'm trying to make the OWASP Top Ten and Guide project known in the programming community, but I understand that clear examples in the specific programming language and best practices with explanation educate the best. I'm at the chair for secure software at my university and I want to contribute practical examples, because I believe not to teach secure programming is a great oversight in today's education. Not only the programmers in large companies have to be aware of security impacts, but also their future employees and their freelance programmers. I'm with a large organization of freelance programmers, which I want to make aware of security flaws.

The Ruby on Rails Security project [20] started this year and is the only security initiative for Ruby on Rails. Ruby is the fastest growing level A programming language, according to the Tiobe programming community index [21], partly because of its advertised simplicity. This is dangerous, as programmers could be enticed to do cargo cult programming [22] without knowing the security impacts. I found several security holes in popular modules, and even the Rails framework itself generates potentially insecure code. Nevertheless, Rails provides good means against many of the OWASP Top Ten security flaws, but I believe these means have to be popularized much more.

Objectives and Deliverables

Create a security guide to the most popular web server software, Apache

Installation

secure configuration, emphasis on Rails, but not limited to it

file system privileges for Rails and Apache

anti profiling techniques for Apache

Modules and Mod_security configuration

Create a security guide to the popular database software, MySQL, as practical contribution to the OWASP Top 10 Insecure storage section

Installation

secure configuration, emphasis on Rails, but not limited to it

file system privileges for Rails and MySQL

MySQL access restriction techniques

encryption methods

Ruby on Rails security guide and code examples, with at least the following topics:

Anti profiling techniques

Rails routes security

error handling and presentation, as in OWASP Top 10 Improper Error Handling

Why I should be sponsored for the project

I have been programming professionally for 10 years and created several software products, including Internet applications, and I always focused on security. I am currently graduating university, my thesis is about web application security. Recently, I started the Ruby on Rails security project, which is the only security project for Rails. I have always delivered my work on time, and I believe I have the knowledge to deliver good quality.

Long-term vision for the project

Make it available to the community and accept security notices and best practices from other users to constantly improve it.

Benefits to the OWASP

practical guides on how to put security into practice: the most popular web server software Apache and the popular database software MySQL

if applicable: additional examples and chapters for the OWASP Guide

the first and only fully-fledged security guide to a programming language and framework which is used by many large companies

security awareness of future employees and freelancers

more exposure of the OWASP

Denis – Python Tainted Mode

I am graduate student of Moscow State University, department of Computational Mathematics and Cybernetics.
My graduate work is dedicated to web-application security. The goal of my graduate work is to combine dynamic code analysis with penetration testing to provide more precise analysis.
This work will help to find security vulnerabilities in web-applications.
I successfully presented parts of my work at university conferences.

My Project

The goal of my project is to create analog of Perl’s Taint Mode for Python programming language.
Taint mode is successfully used in Perl, PHP, and Ruby to find input validation vulnerabilities in web-applications (see for ex. PHPRevent[23]).
Unfortunately there is no implementation of Taint Mode for Python language despite of wide spread of Python-based web-applications. Taint Mode for Python is highly claimed.
I plan to modify Python interpreter and add Taint label propagation. Then I’ll add three configuration lists:

List of sources. All data emanating from sources must be marked tainted.

List of critical functions, that shouldn’t receive tainted data.

List of sanitizing functions that untaints data.

These three lists are dependent on technology that is used between web-server and web-applications in web server. In my project I plan to build such lists for mod_python and then broaden for other technologies. With switched on taint mode web-application will receive exceptions when critical function receives tainted data.

Why should I be selected

I have strong mathematical & computer science background. I’m familiar with research publications on dynamic analysis and with implementation of taint mode in Perl and PHP (PHPrevent Project).
This project is part of my work at university. It will be made under mentoring of my scientific advisor.
This work is already practically done that’s why I’m sure I will finish my project in time.
I have strong skills in developing projects with Python, Java, C, C++, and Assembler. Then I plan to support, develop and enhance my project and increase its quality with penetration testing.

If you have any questions or would like further information, feel free to contact me.

Yours faithfully,
Denis

Darren Edmonds - WebScarab NG Security Test Automation

Background

I am a 28 year old software developer from the UK with a background in java based web development and application security testing. I have strong mathematical skills, a degree in software engineering, a SCJP qualification and 8 years of commercial development experience. I have created many web based and standalone applications delivering on time and adhering to common software practices.
I'm an avid supporter of open source software and try to use it whenever possible in a commercial environment. I've made contributions to the Geotools mapping project, written a securing tomcat article for OWASP and developed a full modification for the first person shooter Quake 3.

Project Details

Having used numerous penetration testing applications I believe there is a need for an open source application which supports some, or all, of the features of the more expensive commercial products. I propose to make WebScarab generate, record, and playback security test cases so that regression testing is possible. If time permits I would also like to include some extra automated tests that are not always feasible during manual testing; searching for backup files (~, Copy of X), checking non-authorised access to authorised areas, common and brute force name directory searching, etc. Perhaps include the ability to read the test database of other scanning tools such as nikto.
I have already made contact with Rogan Dawes, original WebScarab NG author, to discuss some initial ideas. I believe it is important that Rogan is consulted during the initial planning phase to make sure the project keeps to a set of consistent guidelines.

Milestones

Why I Should be Sponsored

I believe I am an ideal candidate to develop the proposed additions to WebScarab NG, not just because of my qualifications and experience, but because I plan to use WebScarab NG in my work to help perform the initial testing of web applications. As well as my own time my current employer will allocate me a set amount of time to ensure the project achieves its milestones.
The end result will make WebScarab NG a much more powerful testing tool and will be a great asset to the OWASP community. With continued development and input from the community I see no reason why WebScarab NG cannot rival commercial testing application features, usability, and business benefit. Increasing WebScarab's features will result in increased community awareness bringing in extra developers, ensuring continual development and so the cycle starts again.

Bernardo - sqlmap

Executive Summary

sqlmap is an automatic blind SQL injection tool, developed in python, capable to perform an active database fingerprint, to enumerate entire remote database and much more. The aim of this project is to implement a fully functional database mapper tool which takes advantages of web application programming security flaws which lead to SQL injection vulnerabilities.

Objectives and Deliverables

Add support for Oracle database management system;

Add support to extract database users password hash;

Extend inband SQL injection functionality to all other possible queries;

Add support for query ETA (Estimated Time of Arrival) real time calculation;

Improve Google dorking support to take advantage of remote hosts affected by SQL injection to perform other command line argument actions;

Improve logging functionality.

Long-term vision for the project

Make sqlmap available as an easy-to-use enumeration and penetration testing tool to the OWASP community extending its functionality to exploit SQL injection vulnerabilities to provide a remote shell on the affected web application database server when possible.
In the long run I would also like to develop a graphical user interface.

Why I should be sponsored for the project

I have good python programming skills and some years of experience in computer networks security. I spent most of the last year researching on web application insecurity taking over the sqlmap development since December 2006. Actually I work as software developer at an information security company in Italy where I mostly deal with vulnerability assessment.

Jim - Best Practices & Countermeasures

Community

I have been running the Buffalo, NY OWASP chapter since 2004. I have been President of ISACA WNY since 2005. I have delivered presentations at Buffalo ISSA, Rochester ISSA, ISACA WNY, and Buffalo OWASP meetings on the topic of Web Application Security.

My Project

The Best Practices & Countermeasures project will outline best practices that should be followed to address/prevent known web application security issues. The best practices will be divided up into related sections. For instance, there will be an "Authentication" section that would have best practices as follows:
1) Require strong passwords
2) For sensitive sites, require two-factor authentication
3) For intranet sites, tie authentication into existing authentication directory server, such as LDAP.
4) Implement account lock-out after 5 failed login attempts
5) Add a log entry and/or an alert to IDS operators after 5 failed login attempts
6) etc.

Each best practice could also have links to language-specific code constructs that show how to implement each best practice.

Long Term

It is my hope that this project can be used not only by developers, but also by IT auditors and security professionals during audits & assessments

Why should I be selected

I have 15 years experience in IT, with 10 years experience in IT Security. I have a bachelor's degree in Computer Science and professional experience as a programmer/developer.

Arshan Dabirsiaghi - OWASP The Anti-Samy Project

My name is Arshan Dabirsiaghi and I am a 25 year old security consultant. I want to open the door for web sites to allow users to supply their own HTML without exposing them to cross-site scripting attacks.

Background

B.S., M.S. in Computer Science (focus on Information Security)

2.5 years security engineer/consultant experience

4 years of web and systems development

8 years of security hobbying

Challenge

Many sites today would enjoy the ability to allow users to provide their own HTML in order to customize their page layout and general user experience. Because of the concerns regarding XSS, it is generally thought of as 'too dangerous' to allow them to input any HTML at all. Sites like MySpace who have been brave enough to provide this functionality have no standardized, proven solution to validate user HTML. In many cases, it's easier to disallow everything that looks HTML or to output encode all their input. Sites like MySpace that have been brave enough to try to attempt this have been the targets of complex attacks. Many sites today don't offer this type of functionality because of concerns for XSS and dangerous HTML.

Objectives

The first goal is to conduct a survey of existing browsers and compare their respective behavior regarding JavaScript (both well-formed and not) inside HTML with regards to W3C specifications

The second goal is to create a software library (versions in both .Net and J2EE) that can accomplish the following goals:

- provide an input validation utility that can detect non-obvious JavaScript inside user-provided HTML
- provide a filtering utility that can take blocks of HTML and strip any JavaScript inside of it while retaining all formatting-related code
- provide these capabilities even when dealing with realistically dirty HTML
- build on the mountain of research available for parsing broken HTML
- provide feedback information to the user to help them tune their source to fall within acceptable values
- provide these capabilities in an API that's simple and portable
- utilize an XML engine file that can be used in various language implementations (.Net/J2EE/PHP)

I envision the project requiring 3 man-months, with a few milestones to be established at reasonable intervals, such as:

Long Term Vision

My goal is to create a peer-reviewed and eventually time-tested solution for detecting and filtering JavaScript from user input. By doing so, we can enable web applications to provide users with richer, more interactive experiences without sacrificing security. This tool will not only provide an input validation component to sites who are currently facing this challenge, but it will also act as an enabler to sites who wished to embrace the new age of user-generated content but were unable to do so because of the risk of XSS.

Josh Sweeney - OWASP LiveCD Education Project

Executive Summary

I am proposing a new project that will educate current OWASP LiveCD users and assist in generating more LiveCD users. The education will be conducted by creating documentation and media using popular tutorial techniques such as Challenges, text tutorials, and video tutorials. The tutorials will help guide all types of users through using the OWASP LiveCD and its tools. After the completion of this project we propose that all of the media be added to the LiveCD so that users have a single all encompassing package to expand their knowledge of application security. This project will effectively bring together documentation for many OWASP projects into one deliverable that can be used at conferences, trade shows, and by educators. The key to promoting a live security distribution is helping the community learn to love every aspect of it.

Objective

The objective is to produce multiple quality instructor led video tutorials and text tutorials that educate users on using the LiveCD and tools within. This will also include in assisting to make sure that the LiveCD is not only an array of tools but a powerful medium for education.

Deliverables

- 5 Full screen video tutorials on using the LiveCD and the OWASP tools on it.

- 5 Text tutorials using the LiveCD and the OWASP tools on it.

- 3 Guided challenge scenarios that help a user learn more about the LiveCD.

- A Morphix module with all educational data included to be added to the LiveCD.

Each deliverable will be OWASP branded so that any distribution ( With OWASP approval )of the material will help bring in new OWASP users.

Why should the OWASP LiveCD Education Project be sponsored?

The LiveCD Education Project should be sponsored because it will help educate current and new users on many OWASP tools in a popular format. Videos are one of the hottest mediums used on the web, the possibilities of reaching people with the deliverables from this project are endless. This can be proven by searching YouTube for BackTrack or by going to other popular security tutorial sites like IronGeek.

Why I should be sponsored.

I currently operate a website ( SecurityDistro.com ) dedicated towards getting the word out and educating people on using live security distributions. Through managing this site I have developed experience in promoting, educating, and writing about live security distributions. I have a continuing interest as well as a tremendous time investment in helping live security distributions succeed.

Before my current full time position in web application security I worked in a managed security services environment where I managed firewalls, IDS, IPS, and various other security devices for companies of all sizes.

NSRAV Security Research Group - Attacks Reference Guide

Background Information

NSRAV [24] is a security research center located at University of Sao Paulo[25], Brazil, with more than 10 years on the information security field. Our team is formed by PhDs, MSc, graduate and post-graduate students and security specialists with GIAC/SANS and CISSP certifications.

We develop research and consulting activities in almost every field of information security, focused on EHT, Web applications, IDS/IPS and detection techniques, grid security, among others.
The group is leaded by Leonardo Cavallari Militelli [26] and Matteo Nava.

Our expectations

We recently started contributing to OWASP and we are developing a Portuguese translated version of Testing guide v2 in order to spread it out to the ones who has potential language barrier.

The maintenance of attacks and vulnerability information is very close to our activities. We believe that we have the specific knowledge and expertise to develop this project.

Executive Summary

We are proposing that we will research about new types of attacks and techniques that aim to Web application/server and report all details about each one. We are intended to explain in details each attack, classify by severity, likelihood of exploitation and impact (when possible), cite references and means of circumvent.

The present OWASP Attacks reference guide lists a great quantity of attacks, but lots of them are lacking explanation and references. For instances, SQL Injection [27] is completely referenced, while Format string [28] has only the topics but no description at all.

Also, we plan to categorize the attacks according to testing guide categories, in order to give a better view of the attacks related to certain test category.

We believe that the Attack reference guide is very important to OWASP since it describes theoretical and practical all the threats a Web application can be susceptible, it gives the reason for OWASP existence.

The vulnerability reference guide is important as well and we will be constantly contributing to maintain it up to date, since it misses lots of information and references on the items. Also, it has almost 600 vulnerabilities and we are quite sure that there are some redundant or even out-of-date items.

Specific activities

As long we will be participating as a group, the activities will be divided as following steps:

Identify all existent attacks at OWASP site.

Research new attacks and techniques

Create test scenarios and exploitation, in order to acquire evidences to be published (when needed)

Detail and reference each attacks, with most known and reliable sources.

Long-term vision for the project

We expect that with a worldwide contribution, the Attack and Vulnerability reference guides can become the most complete and updated security reference available. Also, we expect to create cross-reference among OWASP documents, using the same concepts, definitions, and categories in order to inter-link all the documents.

* My educational and professional background

I'm 24 year old system administrator/it security specialist with 6 years experience.
Also I'm speaker at many different meetings about IT Security (e.g. at OWASP Poland Local Chapter in April 2007) and student Computer Science (last year).

* Application security experience

I have 5 years experience in security audits. Mainly applications for linux/win32 platform, but since 2 years I'm _interested_ web security. I know many attacks vectors, what and how I can do it with security bug and how correct (e.g. changes in code, configuration or something else).
In 2004 year I wrote my first article about bugs in code. Currently I preparing presentation at FIRST! OWASP Poland Local Chapter Meeting about "secure programming in practice".

* Participation and leadership in open communities

I'm member of ISACA Poland and (I hope so!) OWASP Poland Local Chapter.

* Objectives or ways in which you will meet the goal(s)

1) flesh out any item complete from Attacks list
2) complete any item which is not complete or is blank
3) refresh Attacks list, everyday is new for new vectors attacks

* Specific activities and who will carry out these activities

Security education for newbie, medium-advanced and advanced people. Currently mainly via presentation on ISACA Poland meetings. My protector in this education is Shadow (sorry, I don't know in this moment if I mind operate his (first/last)name).

* Specific deliverables and a rough project schedule so we can track progress

My goals list (3 points) is good for make progress bar. First and second goals this is base what I want do it. Third goal is a little research working, but this is what I WANT do it in my life :)

* Long-term vision for the project

If Attacks list is complete (9th July) in cycle on one year this work must be refresh. Very important is update Attacks list every time when you hired about new vector attacks. Why? Because when description about this news vector attacks is not complete, in the next year you don't must making 3 goals, just 2 (first and second). Perfectly when any new item at Attacks list is develop at moment emerge or even though max. 3 months for someone wrote it.

* Any other reasons why you and your project should be selected

Why I? Because I have experience, skills, goodwill and free time.
Why this project? Because this is strong base for education for any programmer, administrator and many others professionals. Knowledge attacks vectors... this is helpful for more secure not only (e-)world.